�b����{�¶U�Zy�M�!mU��J�8p�S�@��]� ��m^�w�y?߬�J��!p�\ z�M���Ɂ(���vz��]w��7$d}g�p�g$g��cj���4�����uO�~�;��������!�6~Bd���!k����z��� H�����uۜ>�a�T���5������V��{��3���L!�N�����O��a������6��XkLB!����ڨj���ʇyРt��Ib�|��R$���l�� S��;1Γ�jC����P�RۢD��\�h2n��l>�J���'���f*���t�p��{�$���Q��?*�cTOR��K$Xx%��,/����Z��_�Q���/�-+Z��p[�����hjlc����n�©���,%�&��i�=Zwt�;ja`�q�Z ���O �RS��q��'K��j8�D��OuB7J@�R��-�b�7zS�ȕ�X4����g�p�Z����Fw���6�Pg�B,D���S�W-������A��JS�#jc��5'9���O�0����M���h`H~��Z�T�����G'��Ǔ�gfz�PxՋ!Q��ƫ��!�1�e��xQ[��zI�/��6�+ԇ6o��۳�B5T�X��[h �\�],�����5���K�߅����oӤ��G�Lf�����5T�@�.� �����j���|29z�|PG1~�z?�g�^mx�e�I!Cf4��MLi��3�E�)T�}�������������p����g�J��d*1�.mu�L�>N�����<�'�*r&0�?�.�b�n惦 W�9�"�x��C{���C��S�i� [P���~MF�MO�.�� �M1v������Ij�<q��/���wɧ@8��{��D$� ��mࠏe}4��>�M皔���aW3Ƕŀ�*66�<�C,#��ù�0�*lbб]�k֊8{�]��Ȁ��7�L�ldrX}��ئ%���TA/X;o-C����狡�����R��L�5_��g��T=_�I�S�]�Pq&��c�6zQp�#�b�կ���=��WH@y�����YE�/�!c�N�5����sH�,�{gU; ̇�$y���\�pb��v�ka��ZVk֧��@���X�c;]b�o��y��]R� �m-�Y2/\�F���gD����( d�(z�ݳ�-9tʚ�Dc ?ʓV*�js��0Ls��Jg:o*�*�o����� �/�i<*퓉`�wQC;#O��M����;��Mt$#���ã��/����3��m�H���!��-ѬX����������6�����3i��;�(�Z�:*DB*ى�T�棎+j�#��[m��8Fyʄ5��� ƭi.��k@8��Ǽj��-��'ڳ�5f�͝T��c����S!B@#5A�!d��:�z[�����]FHLm|!��]!�������>��M������݂����� �A�W�2�apU��3�ƴ"_��,A����]����[ e�|\u=c_��j~��S*��2l�N1��wk�K�LGq�C�>����yiA E�����hB&����d���$Y��k������{�tM^�d�>�C����w"7ڭ��8Q�> ����jS�1]��}v��#r��P��)�dc�АjԎ���րW�|����v)2V��&��u�7����)���7X���_y��w=V��!'�`��6��B]�R� 6v���q��������-y;��ق.����]v!��k����q-ml�q�E�����7d�n�u���)i�_z���)���Wv����n�],AaoP[djj'�&x�v�v:PL3q0C�^��#�;�K�� �JÛhf\m�j�'+}����51��zD�)�І����3���I������(����[���*���a�Ո�MZ����-�A���@(��Y��f�n�(gxӗi�!���^N;�TF�3�����N+c���0��p�%�����8�/3`s��/r�� QXH���UWBI�ۗ� ���7����m��ɏ�"|�bE�|[���� g{Q-���gE�I9�V�G��<�b���=B2����A��<��i- ��B*���t���Y3AF#�.��"}��d�����S�:�i�I��Y�>Ǟ7ٮhTLJK���8�ft����DG��[7K(~���LS�����78)�@ ��d����ݰj�e�G��V;���ľ,Z�g>��%�u�J��_Q�M��,�����eL/��.��H���.� 3�3!1�i�k<���}��]t$Q�� 2���g�6����^NV���l(��A�SlQ0�����t��pw$����'�X��̦�l|w6N���{Xw��V� \�pS��OK�0~4�ǎ$F����#��D�F�� �:�����'UGO*�!_��v ��O�'��g�I�����Lf��C�������3�K֦ ���4�u��M6�Bb�� �X9���qh���\����G������uĪ�8|T�r��jd��wm�-)d���%���R�O��Uόm 8���d�@����;��L�j�����Ĝ�N�{#���P D�����B�%��oc��赢����,B�x������Fml�V[&ъ�f�� ؘ�r�~�_�j#s��R�a���k�$/F�`bTU�����@��� ��O��^�Q�/�I%@�aOa1]���[��w�,L9������ٜ����$0�/����Z;@���� �Ny�����4GLp�����F���,�O�����A����EDs��/��]���W"�d�[�Ƚ�7k˼(n�Gx�9G���"Z�w���|/�������Q\$ø�{\�!��(۷vK�a�Μ�������fE?�"���Q�턤��-h��?Q�}]����|��6�'ӏ|B���5ZbT�m@jȑ��_�Pѽ�}��Ð�D�zt�S ��`p1(f2�oT㚿8k��hu���f���Ǐ������߬�1��`u��4�,ٕ���zS���@ԉ��.��P/Z�b�;�\��O7�~�ԡ&_F=LJ]�v�2��aKp�}T��<���)Kgv-�":Š�<C��I]�~(&�!=U��g�!��8��Xú��B���K
Behavioral task
behavioral1
Sample
超级旺旺群群发王1.2/使用帮助.chm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
超级旺旺群群发王1.2/使用帮助.chm
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
超级旺旺群群发王1.2/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
超级旺旺群群发王1.2/新云软件.url
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
超级旺旺群群发王1.2/超级旺旺群群发王.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
超级旺旺群群发王1.2/超级旺旺群群发王.exe
Resource
win10v2004-20240221-en
General
-
Target
a0900ca5656924b401a7f3f2cc47ae93
-
Size
1.8MB
-
MD5
a0900ca5656924b401a7f3f2cc47ae93
-
SHA1
b134e104d5061557e3bd451b0d3e4fd53eddcfcc
-
SHA256
88b7a6635d52b6b5f143c4ee84a56e8af6bafcaf18312563c7ce0950e02b7d33
-
SHA512
6b4ef24eaf846993779093871102cfc36493bd45eb6b6be9444e6f49ee1f08004be3d502a5559663444140ba65728b5c5d18c1fd85f0d95e3f6226b13075f429
-
SSDEEP
24576:rWz4NAFVoXZB4qXyyiAgGais+RgE+SFAwDyVLwJgR65qHVNZNcFpVw1tv:CJGB4qi5Aciq7SFAQ6L0gZojG
Malware Config
Signatures
-
resource yara_rule static1/unpack001/超级旺旺群群发王1.2/超级旺旺群群发王.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/超级旺旺群群发王1.2/超级旺旺群群发王.exe
Files
-
a0900ca5656924b401a7f3f2cc47ae93.rar
-
超级旺旺群群发王1.2/wwq.mdb
-
超级旺旺群群发王1.2/使用帮助.chm.chm
-
超级旺旺群群发王1.2/广告.txt
-
超级旺旺群群发王1.2/新云软件.url.url
-
超级旺旺群群发王1.2/超级旺旺群群发王.exe.exe windows:4 windows x86 arch:x86
892e0c2db83ea1ca1b5b68a6f238c2cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
gdi32
PatBlt
winmm
waveOutWrite
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
oleaut32
LHashValOfNameSys
odbc32
ord13
comctl32
ImageList_Read
oledlg
ord8
ws2_32
closesocket
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 785KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE